diff options
| author | Nick Mathewson <nickm@torproject.org> | 2012-08-09 10:52:45 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2012-08-09 10:52:45 -0400 |
| commit | 0b21170085c2e868ac90f7771392681b5dfb0ad2 (patch) | |
| tree | d958ba4882dca949d51778ca5afe766176d645fd | |
| parent | 0ea3a3a7a60c92726ffd1795a76666adada9f866 (diff) | |
| parent | 91b52a259a271df7ceeea6d8bf7adbd4d7e15a6c (diff) | |
| download | tor-0b21170085c2e868ac90f7771392681b5dfb0ad2.tar tor-0b21170085c2e868ac90f7771392681b5dfb0ad2.tar.gz | |
Merge remote-tracking branch 'origin/maint-0.2.3'
| -rw-r--r-- | changes/bug6252_again | 11 | ||||
| -rw-r--r-- | src/or/relay.c | 14 |
2 files changed, 25 insertions, 0 deletions
diff --git a/changes/bug6252_again b/changes/bug6252_again new file mode 100644 index 000000000..f7fd00cb3 --- /dev/null +++ b/changes/bug6252_again @@ -0,0 +1,11 @@ + o Security fixes: + - Tear down the circuit if we get an unexpected SENDME cell. Clients + could use this trick to make their circuits receive cells faster + than our flow control would have allowed, or to gum up the network, + or possibly to do targeted memory denial-of-service attacks on + entry nodes. Fixes bug 6252. Bugfix on the 54th commit on Tor -- + from July 2002, before the release of Tor 0.0.0. We had committed + this patch previously, but we had to revert it because of bug 6271. + Now that 6271 is fixed, this appears to work. + + diff --git a/src/or/relay.c b/src/or/relay.c index 3e418ea13..3d261c265 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1265,11 +1265,25 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, case RELAY_COMMAND_SENDME: if (!rh.stream_id) { if (layer_hint) { + if (layer_hint->package_window + CIRCWINDOW_INCREMENT > + CIRCWINDOW_START_MAX) { + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Bug/attack: unexpected sendme cell from exit relay. " + "Closing circ."); + return -END_CIRC_REASON_TORPROTOCOL; + } layer_hint->package_window += CIRCWINDOW_INCREMENT; log_debug(LD_APP,"circ-level sendme at origin, packagewindow %d.", layer_hint->package_window); circuit_resume_edge_reading(circ, layer_hint); } else { + if (circ->package_window + CIRCWINDOW_INCREMENT > + CIRCWINDOW_START_MAX) { + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Bug/attack: unexpected sendme cell from client. " + "Closing circ."); + return -END_CIRC_REASON_TORPROTOCOL; + } circ->package_window += CIRCWINDOW_INCREMENT; log_debug(LD_APP, "circ-level sendme at non-origin, packagewindow %d.", |